Path to this page:
Subject: CVS commit: pkgsrc/lang/go
From: Thomas Klausner
Date: 2014-09-26 15:54:28
Message id: 20140926135428.9497A98@cvs.netbsd.org
Log Message:
Update to 1.3.2 for a security fix:
We've just released Go version 1.3.2, a minor point release.
This release includes bug fixes to cgo and the crypto/tls package.
https://golang.org/doc/devel/release.html#go1.3.minor
The crpyto/tls fix addresses a security bug that affects programs
that use crypto/tls to implement a TLS server from Go 1.1 onwards.
If the server enables TLS client authentication using certificates
(this is rare) and explicitly sets SessionTicketsDisabled to true
in the tls.Config, then a malicious client can falsely assert
ownership of any client certificate it wishes. This issue was
discovered internally and there is no evidence of exploitation.
Files: